Skip to content
This repository was archived by the owner on Aug 8, 2026. It is now read-only.

WP Sudo v2.9.2 — Research Snapshot

Pre-release
Pre-release

Choose a tag to compare

View all tags
@dknauss dknauss released this 28 Feb 04:54
· 1126 commits to main since this release
v2.9.2
2c875eb

Versions before 4.9.0 automatically replayed an intercepted request after reauthentication (#322). Do not use this version.

RESEARCH PROTOTYPE ONLY. Do not install on production, public staging, or any site containing real users, credentials, or data. Use only in WordPress Playground or a disposable local test environment.

What's changed

Bug fixes

  • 2FA help text corrected — Settings → Sudo help tab said "The default 2FA window is 10 minutes". The code default (unchanged since v2.4.0) is 5 * MINUTE_IN_SECONDS — 5 minutes. Help text now reads "5 minutes". Note: the sudo session countdown visible in the admin bar is a completely separate timer; it remains at 15 minutes by default.
  • Version constant drift resolved — phpstan-bootstrap.php and tests/bootstrap.php both defined WP_SUDO_VERSION = '2.8.0' two release cycles after the fact. Both now track the runtime version. Added a Version sync checklist to CLAUDE.md so this can't slip again.

Documentation

  • readme.txt gains a "Why Sudo?" subsection in the Description with Patchstack 2026 exploitation statistics: 57% of all attacks target Broken Access Control, sudo-mitigated classes account for 80% of real-world WordPress exploitation, traditional WAFs block only 12–26%.
  • Eight new FAQ entries added to readme.txt: what problem Sudo solves, how it differs from security plugins, limitations, brute-force protection, implicit login grant, password-change session expiry, grace period, and the 2FA verification window.
  • Integration and unit test counts corrected in readme.txt.

No production logic changes. No database migrations. Safe to update.

397 unit tests, 944 assertions.

Full history: CHANGELOG.md

Assets 2
Loading